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Why GAO Did This Study 

Due to the federal government's 
role as guarantor, floods impose an 
enormous potential financial 
burden on the federal government. 
Consequently, decision makers at 
the Department of Homeland 
Security (DHS), the Federal 
Emergency Management Agency 
(FEMA), and the Congress need 
accurate and timely financial 
information to assess the 
effectiveness of the National Flood 
Insurance Program (NFIP). This 
report assesses whether controls in 
place during the 2005 to 2007 time 
frame were effective and whether 
actions to improve controls are 
likely to address identified 
weaknesses. GAO reviewed and 
analyzed FEMA/NFIP guidance, 
data, and financial reports, 
reviewed prior audit reports, 
interviewed FEMA officials and 
contractors, and selected a sample 
of claim losses paid to determine 
whether claim files contained key 
documents. 
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GAO makes seven 
recommendations to improve NFIP 
financial management controls and 
oversight. FEMA agreed with two 
of GAO's recommendations and 
cited corrective actions under way, 
stated that two recommendations 
were unnecessary because 
sufficient procedures were already 
in place, and disagreed with the 
remaining three recommendations. 
GAO reaffirms the need for all 
seven recommendations. 
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What GAO Found 

Weaknesses in internal controls impaired FEMA's ability to maintain effective 
transaction-level accountability. These weaknesses limited FEMA's ability to 
assure accurate NFIP financial data during the 3-year period from fiscal year 
2005 through 2007, which included the financial activity related to the 2005 
Gulf Coast hurricanes. FEMA relies heavily on Write Your Own (WYO) 
insurance companies to carry out NFIP financial activities such as 
documenting and maintaining claim files. FEMA's Bureau and Statistical 
Agent (BSA) serves as a liaison between the government and WYO insurance 
companies. GAO identified weaknesses at three levels of the NFIP transaction 
accountability and financial reporting process. First, at the WYO level, our 
internal control testing of a statistical sample determined that almost 71 
percent of WYO company claims loss files did not have the necessary 
documents to support the claims, or reports were filed late. Second, 
incomplete BSA-level premium data files (lacking key information such as 
insureds' names and addresses) prevented an assessment of the reliability of 
reported NFIP premium amounts. Further, BSA-level internal control 
activities were ineffective in verifying the accuracy of WYO-submitted data. 
Lastly, FEMA's financial reporting process uses summary data that is overly 
reliant on error-prone manual data entry. 

GAO found that FEMA's broader oversight structures were also of limited 
effectiveness. Specifically, GAO found weaknesses in three key structures 
FEMA relies on to provide oversight over NFIP and monitor financial activity: 
(1) WYO company audits — specifically, we found that FEMA did not collect 
the results of state insurance department audits related to flood insurance 
activity and did not perform any audits for cause; (2) triennial operational 
reviews of WYO insurance companies — we found that FEMA did not perform 
operational reviews at almost one third of all WYO companies over the 3-year 
period; and (3) FEMA's claims reinspection program — we found that FEMA 
used flawed sampling procedures in the claims reinspection program. These 
findings are consistent with weaknesses GAO has previously identified. These 
oversight weaknesses limited FEMA's ability to identify and address financial 
transaction control breakdowns resulting from the 2005 hurricanes. 

FEMA's initiatives to improve specific internal control weaknesses and the 
overall NFIP control environment since the 2005 Gulf Coast hurricanes have 
done little to address many of the NFIP financial data deficiencies highlighted 
by these catastrophic events. FEMA has made improvements such as revising 
its claim reinspection selection methodology to provide for review of a 
random selection of a statistically representative sample of claim files. 
However, the modified reinspection methodology still does not include all 
claims. FEMA has also implemented a tracking system to monitor the number 
of WYO biennial audits obtained and reviewed. Further, FEMA has a system 
modernization development and implementation effort under way. It is too 
soon to determine the extent to which these efforts will achieve program 
efficiencies. 
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4 GAP 

— Accountability * Integrity * Reliability 

United States Government Accountability Office 
Washington, DC 20548 



December 22, 2009 

The Honorable Richard C. Shelby 
Ranking Member 

Committee on Banking, Housing, and Urban Affairs 
United States Senate 

Dear Senator Shelby: 

The Federal Emergency Management Agency (FEMA), a component of the 
Department of Homeland Security (DHS), is charged with administering 
the National Flood Insurance Program (NFIP). NFIP, established in 1968, 
is primarily implemented through private insurance companies that 
participate in FEMA's Write Your Own (WYO) program. Through the WYO 
program, insurance companies sell and service flood insurance policies 
and adjust claims after flood losses. The federal government acts as a 
guarantor of flood insurance coverage for WYO policies issued under the 
WYO Arrangement. As a guarantor, the federal government is liable for 
paying NFIP claim losses should premiums collected be insufficient to 
cover these payments. To the extent possible, the program is designed to 
pay operating expenses and flood insurance claims with premiums 
collected on flood insurance policies rather than by tax dollars. 

Flood losses have imposed an enormous financial burden on the federal 
government. Until 2004, NFIP was able to cover most of its losses. 
However, in order to pay claims arising from the 2005 hurricanes (Katrina, 
Rita, and Wilma), the Congress authorized loans to NFIP of about $16.8 
billion from the Treasury that the program used to cover the enormous 
number of claims. 1 Given this large debt and ongoing complex financial 
challenges created by the 2005 Gulf Coast hurricanes, the fiscal 
sustainability of the flood insurance program has come under scrutiny. 

In March 2006, we designated NFIP as a high-risk program in part because 
of the program's financial condition and inability to repay borrowed funds. 
Since then, we have made recommendations 2 to improve rate-setting 



1 As of December 2008, NFIP owed over $18 billion to the Treasury. 

2 See GAO, Flood Insurance: FEMA's Rate-Setting Process Warrants Attention, GAO-09-12 
(Washington, D.C.: Oct. 31, 2008); National Flood Insurance Program: FEMA's 
Management and Oversight of Payments for Insurance Company Services Should Be 
Improved, GAO-07-1078 (Washington, D.C.: Sept. 5, 2007). 
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methods and program oversight. The program remains on our January 
2009 list of high-risk federal programs. 

This report provides the results of our review of NFIP financial 
transactions related to Hurricane Katrina and other hurricanes of the 2005 
season. Specifically, this report, 

• assesses whether controls were effective in providing accountability 
and reliable financial reporting for NFIP transactions during the 2005 to 
2007 time frame, 

• evaluates oversight structures in place to monitor NFIP financial 
activity for that 3-year period, and 

• assesses whether recent and planned actions to improve NFIP controls 
and the overall control environment are likely to address identified 
financial control weaknesses. 

To assess whether controls were effective in providing accountability and 
reliable financial reporting for NFIP transactions during the 2005 to 2007 
time frame, we obtained and reviewed available transaction data and 
financial reports for NFIP for fiscal years 2005 through 2007. We reviewed 
the WYO Financial Control Plan, WYO Accounting Procedures Manual, 
and other relevant NFIP policy guidance documents to determine the 
design of NFIP financial reporting processes and related internal controls. 
We reviewed NFIP transaction accountability in accordance with the 
guidelines of the Federal Financial Management Improvement Act of 1996 
(FFMIA). 3 We conducted interviews and walkthroughs of reporting 
processes with officials from FEMA, FEMA contractors, and the DHS 
Office of Inspector General (OIG) to document and obtain an 
understanding of the financial reporting process and related internal 
controls for NFIP transactions. We obtained NFIP's databases of claim 
losses paid for fiscal years 2005 through 2007 and selected a statistical 
sample from the insurance claim losses paid databases for testing of data 
fields such as coverage and deductible amounts, claim payment amounts, 
and policy effective dates against source documents. 



Federal Financial Management Improvement Act of 1996, Pub. L. No. 104-208, div. A., § 
101(f), title VIII, 110 Stat. 3009, 3009-389 (Sept. 30, 1996). FFMIA was directed at ensuring 
that federal financial management systems provide accurate, reliable, and timely financial 
management information to government managers. FFMIA requires DHS and 23 other 
major departments and agencies to implement and maintain financial management systems 
that comply substantially with (1) federal financial management systems requirements, (2) 
federal accounting standards, and (3) the U.S. Government Standard General Ledger at 
the transaction level. 
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To evaluate oversight structures in place to monitor NFIP financial activity 
for the 3-year period covering 2005 to 2007, we reviewed prior GAO and 
DHS OIG reports to identify and follow up on any previously reported 
weaknesses or concerns. Previously reported weaknesses included the 
sample selection process for claims reinspections and the lack of tracking 
results of biennial financial audits. We also identified and assessed 
significant oversight structures outlined in the WYO Financial Control 
Plan. 

To assess whether recent and planned actions to improve NFIP controls 
and the overall control environment are likely to address identified 
financial control weaknesses, we met with key program officials to discuss 
the NextGen system-development effort. We also discussed recent and 
planned NFIP program changes to address the internal control 
weaknesses and oversight issues previously identified by us and the DHS 
OIG. Appendix I provides more details on our scope and methodology. 

We conducted this performance audit from February 2008 to December 
2009 in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the audit to 
obtain sufficient, appropriate evidence to provide a reasonable basis for 
our findings and conclusions based on our audit objectives. Our audit 
objectives were not designed to detect fraud. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions 
based on our audit objectives. 



Background. Congress established NFIP in the National Flood Insurance Act of 1968 to 

" provide an alternative to disaster assistance that would reduce the 

escalating costs to the federal government of repairing flood damage. 4 
FEMA, within DHS, administers NFIP and is responsible for its 
management and oversight. Under NFIP's WYO program, FEMA enters 
into an arrangement with individual private-sector insurance companies 
licensed by states to provide property insurance. The arrangement allows 
these companies — using their customary business practices — to offer 
flood insurance coverage to eligible property owners. Figure 1 provides an 
overview of the WYO companies and other key participants in NFIP. 



4 The National Flood Insurance Act of 1968, as amended, is codified at 42 U.S.C. §§ 4001 to 



4129. 
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Figure 1 : Key Participants in the NFIP WYO Program 
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Source: GAO analysis of FEMA data. 



WYO Companies A private insurance company becomes a WYO company 5 by entering into 

an agreement with FEMA known as the Financial Assistance / Subsidy 
Arrangement. Under the arrangement, private insurance companies agree 
to issue flood policies in their own name. The WYO companies adjust 
flood claims as well as settle, pay, and defend all claims arising from the 
flood policies. Participating WYO companies are to comply with FEMA's 
NFIP WYO Program Financial Control Plan Requirements and Procedures 
(Financial Control Plan), which outlines WYO insurance companies' 
responsibilities for underwriting, claims adjustments, cash management, 
and financial reporting. 

Selling policies. NFIP coverage is available to all owners of insurable 
property (a building or its contents, or both) in a community participating 
in NFIP. Builders of buildings in the course of construction, condominium 
associations, and owners of residential condominium units in participating 
communities may also purchase flood insurance. Insurance agents under 
contract to one or more WYO insurance companies are the main point of 
contact for approximately 97 percent of policyholders. Based on 
information the insurance agents submit, the WYO insurance companies 
issue policies, collect premiums from policyholders, deduct an allowance 
for expenses from the premium, and remit the balance to the National 
Flood Insurance Fund. The remaining 3 percent of policies are written 
directly by the federal government through a FEMA contractor known as 



There were approximately 90 WYO companies operating during 2008. 
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the Direct Servicing Agent. 6 The Direct Servicing Agent provides an 
alternative, for example, when a WYO company is unable or unwilling to 
write a flood insurance policy. 

Adjusting claims. Insurance companies employ certified 7 flood adjusters 
to settle NFIP claims. When flood losses occur, policyholders report them 
to their insurance agent, who notifies the WYO insurance company. The 
WYO insurance company assigns a flood adjuster who is responsible for 
assessing damage, estimating losses, and submitting required reports, 
work sheets, and photographs to the WYO insurance company, where the 
claim is reviewed and, if approved, processed for payment. NFIP's claims 
payment policy states that FEMA will pay only that part of the loss that 
exceeds the deductible amount, subject to the applicable limit of liability 
(i.e., the amount of insurance coverage). FEMA provides funds to the WYO 
insurance companies from the National Flood Insurance Fund for the 
amounts paid for approved claims and related expenses. As of December 
2008 the fund was over $18 billion in debt. 



FEMA Management and About 68 FEMA Mitigation Directorate employees, assisted by 
Oversight approximately 105 to 110 Bureau and Statistical Agent 8 (BSA) contractor 

employees, are responsible for managing and overseeing NFIP and the 
National Flood Insurance Fund into which premiums are deposited and 
claims and expenses paid. FEMA and its contractor (the BSA) are 
responsible for monitoring and overseeing the quality of the performance 
of the approximately 90 WYO insurance companies to assure that NFIP is 
administered properly. Their management responsibilities include 
establishing and updating NFIP regulations and flood insurance rates, 
offering training to WYO company insurance agents and adjusters, and 
implementing the Financial Control Plan. 



The Direct Servicing Agent was outside the scope of our review. 

According to the NFIP Adjuster Claims Manual, the Bureau and Statistical Agent (BSA) 
maintains a database of independent adjusters who qualify to adjust flood claims. This 
database reflects whether the adjuster has attended FEMA-recognized flood workshops. 

8 FEMA awards a contract for a BSA, which is responsible for conducting financial and 
statistical reporting based upon data submissions from the WYO companies, developing 
forms and information related to NFIP, and providing various data analyses. The BSA 
serves as the liaison between the government and insurance companies that issue federally 
guaranteed NFIP policies. 
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NFIP's Financial Reporting The NFIP financial reporting process begins at the WYO company level 
Process when the companies provide summary-level financial data and 

transaction-level statistical data to the BSA. 9 The WYO Financial Control 
Plan requires the WYO companies to submit a monthly financial statement 
reporting package to the BSA, which is to include financial, reconciliation, 
and certification statements, and statistical transactions. 10 The BSA uses 
the detailed transaction-level data in the reporting package for statistical 
purposes that include information on claims, losses, and premiums (such 
as claim payment and coverage amounts, data on buildings and contents, 
and policy effective dates). The BSA uploads the summary-level financial 
information to its financial system which is used for financial reporting 
purposes. 

After the BSA receives the reporting package, 11 it performs front-end 
balancing — a process intended to ensure the WYO company data are 
consistent with the WYO companies' reconciliation statements. After BSA 
personnel complete the front-end balancing process they use manual 
processes to upload financial data into the Focus system from a 
spreadsheet. 12 The consolidated financial data in Focus is then 
downloaded to a database to prepare journal entries that are then 
uploaded into the Traverse financial reporting system. The BSA uses the 
Traverse system to prepare the financial statement booklets and ultimately 
produce four financial statements — for the Direct Servicing Agent, WYO 
companies, BSA, and a consolidated report that includes all three entities. 

The BSA sends the financial statement booklets consisting of these four 
sets of consolidated — but unaudited — financial statements to FEMA's 
Office of the Chief Financial Officer (OCFO) monthly. The OCFO prepares 
journal vouchers based on line items from the NFIP consolidated financial 



9 In addition, WYO companies house premium and claim files and related records. 

10 The Transaction Record Reporting and Processing (TRRP) Plan defines the reporting 
requirements applicable to the writing and servicing of policies issued by the WYO 
companies. The plan contains detailed specifications for recording and compiling data. 

H The WYO Accounting Procedures Manual provides templates called "Financial Exhibits" 
for the WYO companies to use in submitting financial data. For purposes of our report, we 
use the term "financial exhibit" when describing the financial statements submitted to the 
BSA by the WYO companies. 

12 BSA personnel upload financial data from spreadsheets the WYO companies submit into 
the Focus mainframe system. These spreadsheets consist of the WYO companies' financial 
statement exhibits in a standard format required by FEMA's WYO Accounting Procedures 
Manual. 
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statements that the BSA provides. OCFO personnel enter these journal 
vouchers into the Integrated Financial Management and Information 
System (IFMIS), which is FEMA/NFIP's official accounting system of 
record. After the journal voucher entries are loaded into IFMIS, OCFO 
personnel produce trial balance data and load it into the Treasury 
Information Executive Repository (TIER), which is a data warehouse for 
DHS' components' data. 

See figure 2, which depicts NFIP's financial reporting processes. 
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Figure 2: NFIP Financial Reporting Process for Fiscal Years 2005 to 2007 
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Weaknesses in NFIP 
Transaction Controls 
and Processing 
Limited 

Accountability and 
Financial Reporting 



Control weaknesses impaired FEMA's ability to maintain effective 
transaction-level accountability. Consequently, NFIP had limited 
assurance that its financial data for fiscal years 2005 to 2007 were 
accurate. This impaired data reliability resulted from weaknesses at all 
three levels of the NFIP transaction accountability and financial reporting 
process: at the WYO companies, BSA, and FEMA. At the WYO level, WYO 
companies did not adhere to policies and procedures regarding required 
claims file documentation, and therefore almost one third of the claims 
loss files we reviewed were missing supporting documents. This 
deficiency undermined assurances regarding the reliability of the claims 
loss financial data the WYO companies reported. Further, incomplete BSA 
premium data files, such as missing insureds' names and addresses, 
prevented our assessment of the reliability of reported premium amounts. 
BSA-level controls were ineffective in verifying the accuracy of WYO- 
submitted data. At the FEMA level, financial reporting process controls 
were not based on transaction-level data — instead FEMA relied primarily 
on summary data compiled using error-prone manual data entry. 



WYO Companies Did Not 
Provide Complete 
Documentation to FEMA 
for Claims Transactions 



The WYO companies did not provide complete documentation to FEMA 
for claims paid to insureds during fiscal years 2005 to 2007. According to 
NFIP policies and procedures, claim loss files are to contain adequate 
documentation relevant to the adjustment of a claim to support claim 
payments. Our detailed testing of claim losses paid during fiscal years 2005 
through 2007 showed that 20 percent (36 out of 177) of the claim files 
reviewed were missing adjuster-prepared preliminary reports 13 and 20 
percent (36 out of 177) did not contain adjuster-prepared final reports 14 



Preliminary reports are to be completed by adjusters for all flood losses and must be 
submitted within 15 days after receipt of the loss assignment. The preliminary report 
documents information on the insurance policy, the risk, and the cause of the loss. 

14 Final reports are also to be completed by adjusters for all flood losses and are due 30 days 
after the preliminary report is submitted. The final report documents information on the 
history of the premises such as date constructed, any alterations, and any prior losses, as 
well as information on the mortgagee, a summary of the claim, and any excluded damages. 
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required by the NFIP Adjuster Claims Manual. 15 In addition, for the claim 
files we reviewed, WYO companies did not file 42 percent (74 out of 177) 
of the preliminary and 34 percent (61 out of 177) final reports within the 
required 15 and 45 days, respectively, from the date of loss in accordance 
with NFIP policy. Our findings are consistent with prior audit findings. 
Specifically, DHS' auditor for its financial statement audit for fiscal year 
2006 reported that preliminary and final reports were not filed within the 
required time frames. Similarly, almost 71 percent (125 out of 177) of the 
statistically sampled claim losses paid files we reviewed failed at least one 
internal control test. These included tests such as determining whether 
claim file documents were missing and whether adjusters filed required 
reports on time or late. Although FEMA officials pointed to the 
unprecedented severity, frequency, and complexity of flood claims during 
this period, these internal control issues identified raise concerns that the 
claim payment amounts were not adequately supported. 



The BSA's Premium Over 50 percent of the transactions in the NFIP databases for the 

Database Was Incomplete insurance premium policies for fiscal years 2006 and 2007 that the BSA 

extracted for our testing either lacked or had incomplete insured names, 
addresses, or policy effective dates. Consequently, we were unable to test 
the accuracy of reported insurance premium amounts or whether policy 
premium information was complete. Officials from the BSA attributed the 
missing or incomplete insurance premium information to their extraction 
process and difficulties they encountered (programming errors) when 
extracting the data into a separate database specifically for our use. 
Furthermore, the fact that BSA officials could not readily produce reliable 
or complete data poses questions regarding their capacity to analyze data 
and the NFIP program officials' ability to identify appropriate managerial 
actions based on what is reported to them by WYO companies through 
their own BSA contractor. 



15 We noted that 35 of these claim files missing preliminary and final reports are for claims 
adjusted by one particular WYO company. According to FEMA, this WYO company has 
historically taken the position that they will provide the information required but will do so 
in accordance with the processing of all its insurance policies as allowed by the Financial 
Assistance / Subsidy Arrangement. In other words, it will use its own forms that contain the 
information in the NFIP preliminary and final reports. While complying with the Financial 
Assistance / Subsidy Arrangement, based on our review of the information in the claim files 
as compared to the standard preliminary and final reports, we noted that the company's 
forms in the files do not contain certain information such as any salvage amount and the 
prior condition of the building and contents. In addition, the forms are not consistently 
signed by the adjuster and it is not clear whether the reports were prepared timely. 
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We developed alternative procedures that we planned to use to make 
conclusions about the reliability of reported insurance premiums written 
amounts. These alternative procedures involved testing the premium and 
policy information from the sample we selected for claims losses paid. 
However, we were unable to verify information in the premiums database 
for many sample items because of the missing information described 
previously and because of limitations in the quality of the data. 



BSA-Level Internal 
Controls Do Not Verify 
Accuracy of WYO 
Company Data 



We found weaknesses in two key controls outlined in the Financial 
Control Plan for the BSA to ensure the accuracy of WYO company- 
submitted data. These controls include front-end balancing, which is a 
process intended to ensure the WYO company data are consistent with the 
WYO companies' reconciliation statements, and variance reporting, which 
analyzes WYO-submitted transaction-level (statistical) data in comparison 
with summary-level financial data submitted by WYO companies. These 
features do offer some assurances regarding the consistency of data 
provided by WYO companies and recorded by the BSA. However, neither 
offers any assurances that the WYO company-provided information 
accurately reflects actual transactions. Consistent with Standards for 
Internal Control, 16 an agency must have sufficient controls in place to 
provide reliable information to run and control its operations. Such 
controls generally include procedures to verify the validity and accuracy 
of the recorded transactions or events. 



Every month, after receiving summary financial and transaction-level 
statistical data 17 from WYO companies, the BSA performs front-end 
balancing. As provided by the Financial Control Plan, front-end balancing 
is a process intended to ensure the WYO company data are consistent with 
the WYO companies' reconciliation statements that compare the statistical 
transaction data to selected financial exhibit entries. This process is 
intended to validate that the BSA has recorded the same information that 



GAO, Internal Control Management and Evaluation Tool, GAO-01-1008G (Washington, 
D.C.: August 2001). 

''The WYO Financial Control Plan requires WYO companies to submit a monthly financial 
statement reporting package to the BSA. This package is to include financial statements, 
reconciliation statements, certification statements, and statistical transactions. The WYO 
Accounting Procedures Manual provides templates called "Financial Exhibits" for the WYO 
companies to use in submitting financial data. For purposes of our report, we use the term 
"financial exhibit" when describing the financial statements submitted to the BSA by the 
WYO companies. 
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individual WYO companies have transmitted. The BSA's front-end 
balancing, while helping to verify that the number of records and dollar 
amounts agree to the reconciliation documents and the timeliness of the 
WYO-submitted data, does not verify or validate the data's accuracy. 
Although WYO companies submit statistical transaction-level data for 
claims losses paid and premiums written, which are the primary sources of 
financial activity for NFIP, the BSA does not base its financial reporting on 
this transaction-level data, but instead compiles the financial exhibits 
submitted by the WYO companies, and therefore reduces assurances that 
activity reported to FEMA represents actual transactions between WYO 
companies and policyholders. 

The BSA's monthly variance reporting 18 was also not designed to ensure 
WYO company data accuracy. The Financial Control Plan requires the BSA 
to analyze WYO-submitted transaction-level (statistical) data in 
comparison with summary-level financial data submitted by WYO 
companies and produce a report identifying any differences. BSA 
personnel told us that various parties, such as the Standards Committee, 19 
use the Consolidated Variance Report to monitor the statistical data and 
financial information reported by the WYO companies. However — much 
like front-end balancing — the usefulness of the variance reporting process 
was limited because the BSA review was not designed to check the 
underlying NFIP transaction data submitted by WYO companies against an 
independent source for accuracy or completeness. 



The Design of FEMA's 
Financial Reporting for 
NFIP Activity Increases 
Risk 



Along with the internal control weaknesses discussed previously, the 
design of FEMA's NFIP financial reporting process increased the risk of 
inaccurate or incomplete data because it did not include a process of 
analyzing the detailed data for accuracy or analyzing the financial reports 
in relation to the transaction-level data currently submitted by WYO 
companies for statistical purposes. Finally, the process places an 



Variance reporting is the preparation of a report — by the BSA using spreadsheet 
software — that shows variances or differences between financial information and 
statistical information. This report also tracks year-to-date and historical financial and 
statistical information. 

19 The Standards Committee meets three times a year (and is alerted to WYO company 
activity by the BSA and FEMA officials throughout the year) to discuss the status of NFIP 
on such topics as WYO company performance issues and material variances between 
statistical and financial data in excess of 1 percent or $50,000 for Net Written Premium or 
Net Paid Losses or $5,000 for Federal Policy Fees. 
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overreliance on manual procedures for processing and entering data. The 
design weaknesses increase the likelihood of incomplete or inaccurate 
NFIP financial information. 

As FEMA's NFIP financial reporting process was designed, approximately 
90 WYO insurance companies submit summary financial information in e- 
mails to the BSA for consolidation and submission to FEMA. Throughout 
the entire process, the BSA captures and processes key financial 
information such as net written premiums on the financial statements 
prepared by the WYO companies. By presenting the net written premium 
amount, a WYO company does not show how much of its earned 
premiums went to pay premium refunds. This process limits management 
and audit visibility into identifying and resolving any underlying 
transaction reliability issues because it does not show different 
components of transactions. Furthermore, even when detailed transaction- 
level financial data were available, we found that supporting 
documentation was missing. Absent supporting transaction information, it 
was not practical for FEMA to reconstruct or validate NFIP amounts 
reported. 

FEMA's reliance on unverified WYO data and manual processing as 
described in the background section of this report greatly increases the 
chances of errors or misstatements. Similarly, a reliance on net 
(aggregated) data increases the risk of undetected data errors at the FEMA 
level. As a result, in fiscal year 2006, for example, FEMA OCFO officials 
had to correct over 100 journal vouchers totaling an estimated $260 billion. 
These errors occurred because FEMA OCFO officials erroneously 
recorded NFIP financial activity during fiscal year 2006. According to 
Standards for Internal Control implementation guidance, excessive 
adjustments to numbers or account classifications should not be 
necessary prior to finalization of financial reports. Proper classification 
and recording of transactions or events should take place throughout the 
entire life cycle of each transaction or event, including authorization, 
initiation, processing, and reporting. 
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Weaknesses in 
FEMA's Oversight 
Structures Limited 
Effectiveness in 
Monitoring NFIP 
Financial Activity 



Weaknesses in the broad oversight structures that FEMA relies on to 
monitor NFIP financial activity in three key areas limited the effectiveness 
of FEMA's oversight: (1) FEMA did not have processes to monitor WYO 
company audits by independent public accountants and other parties, 
including required biennial audits, state insurance department audits, and 
audits for cause; (2) FEMA did not perform triennial operational reviews 
of all WYO insurance companies; and (3) FEMA's claims reinspection 
program used flawed sampling procedures. These weaknesses are 
consistent with issues identified in our prior reports. As a result of these 
oversight deficiencies, FEMA's ability to identify and address NFIP 
financial transaction control breakdowns when processing transactions 
related to the 2005 Gulf Coast hurricanes was limited. 



FEMA Did Not Monitor 
Completion or Results of 
WYO Company Audits 



FEMA did not have any mechanism for tracking completion and reviewing 
the results of required biennial financial statement audits of WYO 
companies, did not collect results of state insurance department audits 
related to flood insurance activity, or conduct audits for cause. According 
to the Financial Control Plan, biennial audits are FEMA's primary 
oversight mechanism for obtaining assurance that it receives complete and 
accurate financial management information from WYO insurance 
companies. The plan provides that such audits are intended to reduce or 
eliminate the need for FEMA auditors to conduct on-site visits to WYO 
insurance companies to oversee their financial activities; specifies that 
biennial financial statement audits are a required condition of an 
insurance company's participation in the WYO program; and states that 
they must be conducted by an independent Certified Public Accountant. 20 
According to the Financial Control Plan, these audits are to include an 
opinion on the fairness of the financial statements, the adequacy of the 
internal controls, and the extent of compliance with laws and regulations. 
In 2007, we reported that 5 out of 94 (about 5 percent) WYO companies 
had biennial audits completed for the 2-year period covering fiscal years 
2005 and 2006. 21 In response to findings that FEMA had failed to 
consistently enforce the biennial audit requirement, FEMA officials told us 
that they had exempted from this requirement companies that said that 



According to GAO's previous report, National Flood Insurance Program: FEMA's 
Management and Oversight of Payments for Insurance Company Services Should Be 
Improved (GAO-07-1078), biennial audits were not performed consistently as required by 
regulation. 

21 See GAO-07-1078. We did not evaluate the quality of the biennial audits conducted. 
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they were overwhelmed with administering flood claims after the 2005 
hurricane season. 

The Financial Control Plan also requires FEMA to consider the results of 
other audits of the WYO companies such as state insurance department 
audits, as appropriate. Based on our testing of FEMA's compliance with 
the Financial Control Plan, we reported in August 2009 22 that FEMA rarely 
or never reviewed state insurance department audits. FEMA officials 
clarified that state departments of insurance audits require a "trigger." For 
such audits, a financial officer of the insurer is to "trigger" an alert to 
FEMA of any state audit involving NFIP activities. A more independent 
way for FEMA to learn of these audits would be to have contact directly 
with the states. According to FEMA, during our review period, FEMA did 
not receive any such notices. These audits are typically in response to 
company-specific concerns — they are not routine. 

The Financial Control Plan outlines criteria that, in combination or 
independently, may prompt FEMA to perform an audit for cause. Based on 
our testing of FEMA's compliance with the Financial Control Plan, we 
reported in August 2009 23 that FEMA rarely or never implemented audits 
for cause. According to FEMA officials, the last audits for cause were done 
in the late 1990s. Because FEMA did not systematically track and centrally 
store all required evaluations, inspections, audits, or reviews, FEMA 
management had no basis for timely access to them or effectively 
overseeing the 90-plus participating insurance companies, and therefore 
had no reasonable basis for determining whether any audits for cause 
were necessary. FEMA told us that based on our August 2009 
recommendations, it now plans to implement such a system. It will be 
important for FEMA to maintain ongoing awareness of state audit 
initiatives identified through an independent information source. 



See GAO, Flood Insurance: Opportunities Exist to Improve Oversight of the WYO 
Program, GAO-09-455 (Washington, D.C.: Aug. 21, 2009). 

23 See GAO-09-455. 
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Operational Reviews Are FEMA did not perform operational reviews for all WYO companies on a 
Ineffective triennial basis as required and used a flawed sampling methodology to 

select underwriting files at the WYO companies that it did review. 24 The 
Financial Control Plan calls for conducting the following types of 
operational reviews: underwriting/policy administration; claims; 
marketing; customer services; and litigation. 25 These reviews are intended 
to provide FEMA with an effective mechanism to monitor, identify, and 
resolve problems related to how WYO companies sell and renew NFIP 
policies and adjust claims. According to Standards for Internal Control 
implementation guidance, 26 information should be available on a timely 
basis to allow effective monitoring of events, activities, and transactions 
and to allow prompt action. Given that operational reviews are FEMA's 
primary method to monitor the WYO insurance companies for the two 
most significant areas of the program — underwriting and claims 
processing — it is important for FEMA to conduct these reviews on a 
regular basis. 

Without the timely information regarding how WYO companies sell and 
adjust claims gained through operation reviews, FEMA cannot be certain 
that the WYO companies provide appropriate financial information to 
NFIP program managers. Policies and procedures specify that all WYO 
companies are to be reviewed at a minimum every 3 years. Therefore, we 
expected that FEMA would have done an operational review of all the 
WYO companies during the 3-year period covering 2005 to 2007. However, 
as shown in figure 3, we found that FEMA had completed operational 
reviews on only 71 percent (82 out of 116) of WYO companies during this 
period. 



According to GAO's previous report, Federal Emergency Management Agency: 
Improvements Needed to Enhance Oversight and Management of the National Flood 
Insurance Program, GAO-06-119 (Washington, D.C.: Oct. 18, 2005), the process FEMA 
used to select a sample of claims files for operational reviews and the process its program 
contractor used to select a sample of adjustments for reinspections did not produce a 
sample that was randomly chosen or statistically representative of all claims. 

25 FEMA officials told us that they are revising the Financial Control Plan and no longer 
perform marketing, customer services, and litigation operational reviews. There were no 
reviews of this type performed during the period of our review (fiscal years 2005 to 2007). 
The FEMA officials said each of these functions were being reviewed by other methods; 
however, we reported that the draft Financial Control Plan did not incorporate these other 
methods. 

26 GAO, Internal Control Management and Evaluation Tool, GAO-01-1008G (Washington, 
D.C.: August 2001). 
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Figure 3: WYO Companies with Operational Reviews Completed by FEMA in Fiscal 
Years 2005 through 2007 




WYO companies that did NOT have 
operational reviews completed 




WYO companies that had 
operational reviews completed 



Source: GAO analysis of data provided by FEMA. 



FEMA's Flawed Sampling 
Procedures Hamper Its 
Claims Reinspection 
Program 



Further, as previously reported, 27 FEMA did not use a statistical sampling 
methodology to select files for operational reviews — instead it uses 
nonprobability sampling processes. In nonprobability sampling, staff are 
to select a sample based on their knowledge of the population's 
characteristics. The major limitation of this type of sampling is that the 
results cannot be generalized to a larger population. A nonprobability 
sample is therefore not appropriate to use if the objective is to generalize 
about the population from which the sample is taken. 28 



According to FEMA's Financial Control Plan, the claims reinspection 
program is to serve as a mechanism supporting FEMA's oversight of WYO 
insurance companies. The objectives of the claims reinspection program 
were to (1) keep FEMA and the BSA informed, (2) assist in the overall 
claims operation, and (3) provide necessary assurances and 
documentation for dealing with external parties. The BSA is to conduct all 
reinspections and prepare a report documenting the appropriateness of 



2 'See GAO-06-119. 

28 GAO, Policy Manual (Washington, D.C.: Jan. 1, 2004). 
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the original claims adjuster's work. However, we found that FEMA did not 
use a statistical sampling basis for selecting claims for reinspection. 
Specifically, adjusters selected claims to reinspect based upon judgmental 
criteria including, among other items, the size and location of loss and 
complexity of claims. Further, FEMA only required testing for a selection 
of claims for flood events with over 400 claims per a single flood event for 
a particular WYO company. Also, the actual number of claim losses 
selected for reinspection only represents a very small percentage of the 
total number of claim losses processed. Using this flawed methodology for 
selecting samples for claims reinspections, the percentage of claims 
reinspected by flood event for fiscal years 2005 and 2006 was 1.8 percent 
for Katrina, 3.6 percent for Rita, and 5.0 percent for Wilma. By using a 
statistical sampling methodology for selecting claim reinspections, FEMA 
would be able to use this oversight mechanism to make conclusions about 
the accuracy of the total amount of claims losses paid, with a similar level 
of effort. 

These findings are consistent with findings from previous audits. 
Specifically, we previously reported in October 2005 29 that neither FEMA 
nor its program contractor used a statistically valid method for selecting 
files for reinspections of claims adjusted after each flood event because 
FEMA guidance did not include procedures on the sample selection 
process. Without a statistically valid sampling methodology that 
represents the population, the agency cannot project the results of these 
reinspection oversight activities to confidently determine the overall 
accuracy of claims settled for specific flood events or assess the overall 
performance of insurance companies and their adjusters in fulfilling their 
NFIP responsibilities. In December 2006, we again reported 30 that FEMA 
neither used a random sample of claims for its reinspections nor analyzed 
the overall results of those reinspections to determine the total number of 
payment errors and their potential causes. 



" a See GAO-06-119. 

30 See GAO, National Flood Insurance Program: New Processes Aided Hurricane Katrina 
Claims Handling, but FEMA's Oversight Should Be Improved, GAO-07-169 (Washington, 
D.C.: Dec. 15, 2006). 
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Recent and Planned 
Initiatives Do Little to 
Address Identified 
Weaknesses 



FEMA has revised its draft Financial Control Plan (dated August 2009) to 
require selection of a statistically representative sample of claim files for 
its reinspection reviews. However, the modified policy continues to cover 
only those claims associated with single flood events with over 400 claims 
per WYO company. Substantial claims activity may still be excluded from 
reinspection. For fiscal years 2005 and 2006, almost $1.5 billion of the 
$16.5 billion in claims filed would not have been considered for 
reinspection under this criterion. Until processes are modified to make all 
cases eligible for reinspection, FEMA will not be able to effectively 
determine whether the case population is complete as well as whether the 
total amount of claims losses paid is reasonable. 



Available data indicate that the number of biennial financial audits has 
increased since FEMA began tracking the results in fiscal year 2008. Figure 
4 shows that few audits were conducted for fiscal years 2005 and 2006, but 
that there was considerable improvement for fiscal years 2006 and 2007. 
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Figure 4: Companies That Had Biennial Financial Audits Completed or Not 
Completed for Fiscal Years 2005 through 2007 
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Source: GAO analysis of data provided by FEMA. 

Note: As the biennial audits cover a 2-year period, the fiscal year 2005 to 2006 audits were 
completed in fiscal year 2007 and the fiscal year 2006 to 2007 audits were completed in fiscal year 
2008. 

Prior to fiscal year 2008, FEMA had not tracked and reviewed these audit 
results because FEMA did not follow NFIP policies and procedures 
requiring it to receive and analyze such information. Accordingly, FEMA 
could not determine whether it received and reviewed all required audit 
reports, nor have a basis for monitoring implementation of necessary 
corrective actions. In response to our previous recommendation regarding 
this long-standing concern, FEMA is now using a tracking mechanism to 
document audit reports received and those reviewed by FEMA staff. 31 
According to FEMA, once the financial audit reports are received, staff 
and management now review the audit reports and document the results 



'See GAO-07-1078. 
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of their review on the tracking schedule. While improvements have been 
made with regard to tracking and reviewing the results of biennial audits, 
this is only one component of FEMA's oversight structure and, as 
discussed in this report, we continue to note weaknesses in the other 
areas. 

FEMA has a system development and implementation effort, referred to as 
NextGen, 32 under way. This effort has experienced delays and it is too 
soon to determine whether planned program efficiencies — such as 
confirmation of insured's property address — will be achieved under the 
new system. According to FEMA, the NextGen system implementation 
effort is designed to be an insurance system that links key data elements 
like claims and policies through shared processes. Under the current 
system, the BSA maintains claim losses paid and premium policies data in 
separate databases. FEMA officials have expressed concern about the 
readiness of the NextGen system to support NFIP program operations. 



As currently designed and implemented, FEMA's internal controls over 
NFIP offer limited transaction-level accountability and assurances that 
financial reporting is accurate or that insurance company operations 
conform to program requirements. Transaction-level accountability and 
reporting to administer NFIP are fundamental to attaining accountability 
over program resources. Internal controls are also critical to ensure that 
claim payments are adequately supported, and FEMA was missing key 
documentation to support claims. Given the involvement of multiple 
private entities participating in this insurance program, establishing and 
implementing effective policies and procedures to thoroughly implement 
required audits and overall operational and targeted reviews will be 
critical for FEMA to exercise its managerial responsibilities. FEMA has 
taken some steps to strengthen NFIP internal controls such as overseeing 
WYO companies by tracking and reviewing the results of their required 
biennial financial audits. The enormous potential financial burden on the 
federal government that flood events pose, coupled with the risks of 
inaccurate and incomplete NFIP financial information described in this 



According to FEMA, NextGen is intended to be a full life-cycle NFIP technology- 
modernization effort focused on providing business-driven solutions for the NFIP BSA 
using state-of-the-art, industry-proven technologies. The principal NextGen project goals 
are to improve BSA and WYO company processes to benefit all NFIP stakeholders, while 
achieving more efficient and effective program operations. We currently have work under 
way looking at this system. 
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report, serve to underscore that effective NFIP controls are critical. As 
such, it will be important to take immediate actions to improve these 
controls over NFIP transactions, financial reporting, and oversight. 



To improve the financial reporting process and strengthen internal 
controls, we recommend that the Secretary of Homeland Security direct 
the Acting Assistant Administrator, FEMA Mitigation Directorate, to take 
the following seven actions: 

• Augment NFIP policies to require the BSA to develop procedures to 
analyze financial reports in relation to the transaction-level information 
that WYO companies submit for statistical purposes. 

• Revise required internal control activities for the BSA to provide for 
verifying and validating the reliability of WYO-reported financial 
information based upon a review of a sample of the underlying 
transactions or events, or obtain verification that these objectives have 
been met through independent audits of the WYO companies. 

• Determine the feasibility of integrating and streamlining numerous 
existing NFIP financial reporting processes to reduce the risk of errors 
inherent in the manual recording of accounting transactions into multiple 
systems. 

• Establish and implement procedures to require reviewing available 
information such as the results of biennial audits, operational reviews, and 
claim reinspections to determine whether the targeted audits for cause 
managerial tool should be used. 

• Establish and implement procedures to require maintaining and 
considering current information from an independent source regarding 
state audit results to gather pertinent information such as customer 
service issues and inform determinations about when to conduct audits 
for cause. 

• Establish and implement procedures to schedule and conduct all required 
operational reviews within the prescribed 3-year period. 

• Establish and implement procedures to select statistically representative 
samples of all claims as a basis for conducting reinspections of claims by 
general adjusters. 



We requested comments on a draft of this report from the Secretary of 
Homeland Security. Comments received from the DHS Departmental 
GAO/OIG Liaison Office on behalf of FEMA are reprinted in appendix II. In 
its comments, FEMA concurred with two of our recommendations, stated 
that two recommendations were unnecessary in that the recommended 



Recommendations for 
Executive Action 



Agency Comments 
and Our Evaluation 
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procedures were already in place, and disagreed with the remaining three 
recommendations. We reaffirm all seven recommendations. 

With respect to the recommendations for which FEMA concurred 
regarding (1) streamlining financial reporting processes and (2) 
conducting operational reviews, FEMA noted it has actions under way to 
integrate and streamline numerous existing financial reporting processes 
in the design of a new NFIP system, and stated that its new operational 
review process will address our recommendation to schedule and conduct 
all required operational reviews within the prescribed 3-year period. 

Regarding our recommendation for establishing and implementing 
procedures for reviewing all available audit and other reports, FEMA 
stated that it already had a process in place to review WYO company 
performance and trigger audits for cause. FEMA further commented that 
the Standards Committee considers the results of biennial audits, 
operational reviews, and claims reinspections when it reviews company 
performance and considers whether to recommend audits for cause. We 
disagree that the process FEMA has in place is sufficient to address our 
recommendation. As discussed in our draft report, during the period of our 
review, FEMA management, including the Standards Committee, lacked 
timely access to all audit and other reports because FEMA did not 
systematically track and centrally store all required evaluations, 
inspections, audits, or reviews. Therefore, without further action to 
establish additional procedures directed at ensuring access and a 
systematic review of WYO company performance, FEMA will continue to 
be unable to effectively oversee the 90-plus participating insurance 
companies or determine whether any audits for cause are necessary. 

Also, regarding our recommendation concerning selecting statistically 
representative samples of claims for reinspections, FEMA stated that the 
reinspections are not intended to be a definitive audit of the NFIP's claims 
handling process, and cited the random sample of claims it currently has 
in place. We disagree. As discussed in our draft report, adjusters selected 
claims to reinspect based upon judgmental criteria, not on a random 
sample. Further, FEMA only required reinspection when there were more 
than 400 claims per flood event for a particular WYO company. Because 
reinspections are conducted principally on open claims files to document 
the appropriateness of the original claims adjuster's work, the lack of a 
statistically representative sample not only precludes FEMA from 
projecting the results of these reinspections to determine the overall 
accuracy of claims, it also limits FEMA's ability to continuously assess the 
overall performance of insurance companies and adjusters in fulfilling 
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their NFIP responsibilities. FEMA also noted that claims operational 
reviews are designed to provide feedback on claims settlements and 
ascertain compliance by WYO companies. The claims operational reviews 
that FEMA cited, while an important oversight mechanism, do not allow 
for continuous feedback concerning the overall insurance company 
performance. 

We also continue to reaffirm our three recommendations for which FEMA 
disagreed in its comments on our draft report. First, with respect to our 
recommendations that FEMA develop financial reports using the 
transaction-level information that WYO companies currently submit for 
statistical purposes, FEMA stated that implementing our recommendation 
would be onerous and burdensome because of the number of transactions 
involved. We subsequently adjusted our recommendation to have NFIP 
augment its policies to require the BSA to develop procedures to analyze 
financial reports in relation to the transaction-level information that WYO 
companies submit for statistical purposes. Such a procedure would help 
compensate for the risks introduced by the current approach of entering 
summary-level information to its financial reporting system. Because WYO 
companies already submit transaction-level data on claims losses paid and 
premiums written and FEMA uses this information for statistical purposes, 
using these transaction-level financial data to increase the reliability of 
FEMA's financial reporting should impose minimal additional burden. 

Also, with respect to FEMA's nonconcurrence with our recommendation 
to verify and validate WYO-reported financial information, FEMA 
maintained that the form and structure of the transaction-level detail is 
audited at the source, including consideration of the relevance, reliability, 
and accuracy of the transaction-level detail. However, as discussed in our 
report, during the period of our review, we were not provided any 
evidence showing that FEMA obtained any assurances concerning the 
accuracy or validity of WYO company transaction-level financial data. 
Specifically, FEMA did not demonstrate that it had mechanisms in place 
during fiscal years 2005 through 2007 for receiving and reviewing the 
results of the required biennial financial statement audits of WYO 
companies, or for tracking completion of these audits. FEMA was unable 
to provide evidence of whether all WYO companies had completed 
biennial audits and had not reviewed the results of these WYO company 
biennial audits. Further, as discussed in our report, FEMA officials 
exempted certain WYO companies from the biennial audit requirement 
after the 2005 hurricane season. Therefore, FEMA had no assurance as to 
the accuracy or validity of WYO company transaction-level financial data. 
We reaffirm our recommendation that FEMA revise required internal 
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control activities for the BSA to provide required procedures for verifying 
and validating the reliability of WYO-reported financial information based 
upon a review of a sample of the underlying transactions or events. We 
also adjusted our recommendation to include the option for FEMA to 
obtain assurance of the reliability of WYO company-reported financial data 
by verifying that those objectives were met through the independent 
audits of WYO companies. 

Finally, FEMA did not concur with our recommendation to maintain and 
consider information from an independent source regarding state audit 
results in determining whether to conduct audits for cause. FEMA 
contended that such sources do not focus on federal programs, such as 
NFIP. However, FEMA's Financial Control Plan states that it is expected 
that audits of WYO companies by state insurance departments will include 
flood insurance activity. Further, FEMA acknowledges receiving 
information from a source independent of the WYO companies. 
Specifically, it acknowledged receiving correspondence from state 
insurance departments regarding issues of customer service with the WYO 
companies. It is important for FEMA to establish and implement 
procedures to require maintaining and considering all current information 
available from an independent source regarding state audit results. We 
found that FEMA rarely received or reviewed information from state 
insurance department audits. Consequently, we continue to reaffirm our 
recommendation to obtain and consider independent information on state 
audits of the WYO companies, rather than continuing to rely solely on the 
WYO company that underwrites policies and processes claims to alert 
FEMA of any state issues. 

FEMA also expressed concern over several points in our draft report's 
narrative. We continue to affirm the process descriptions and the findings 
in our draft report but made several changes in the report to clarify the 
narrative. Our responses to other FEMA concerns with our draft's 
narrative are provided following FEMA's comments in appendix II. 



As agreed with your office, unless you publicly announce the contents of 
this report earlier, we plan no further distribution until 30 days from the 
report date. At that time, we will send copies to the Secretary of Homeland 
Security, relevant congressional committees, and other interested parties. 
The report will also be available at no charge on our Web site at 
http://www.gao.gov. 

If you or your staff have any questions about this report, please contact me 
at (202) 512-9095 or raglands@gao.gov. Contact points for our Offices of 
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Congressional Relations and Public Affairs may be found on the last page 
of this report. GAO contact and staff acknowledgments are listed in 
appendix III. 

Sincerely yours, 



Susan Ragland 

Director, Financial Management and Assurance 



Page 26 



GAO-10-66 NFIP Financial Transactions 



Appendix I: Scope and Methodology 



To assess whether controls were effective in providing accountability and 
reliable financial reporting for National Flood Insurance Program (NFIP) 
transactions during the 2005 to 2007 time frame, we obtained and reviewed 
available transaction data and financial reports for NFIP for fiscal years 
2005 through 2007. We selected these years to identify transactions 
relevant to the 2005 Gulf Coast hurricanes and to capture more current 
financial information. We reviewed the Write Your Own (WYO) Financial 
Control Plan, WYO Accounting Procedures Manual, and other relevant 
NFIP policy guidance documents to determine the design of NFIP financial 
reporting processes and related internal controls. We reviewed NFIP 
transaction accountability in accordance with the guidelines of the Federal 
Financial Management Improvement Act of 1996 (FFMIA). 1 We also 
interviewed Federal Emergency Management Agency (FEMA), FEMA 
contractors, and Department of Homeland Security (DHS) Office of 
Inspector General (OIG) officials to document and obtain an 
understanding of the financial reporting process and related internal 
controls for NFIP transactions. We conducted walkthroughs to understand 
the reporting process for financial transactions including the review of 
related evidentiary supporting documentation, including journal vouchers 
and adjusting journal entries. Further, to determine how the financial 
transactions were recorded, specifically insurance premiums written and 
claim losses paid, we reviewed NFIP financial reports and met with NFIP 
program and FEMA officials to obtain an understanding of the processing 
cycles for premiums written and claim losses paid. We interviewed FEMA 
personnel and contractors responsible for collecting and maintaining NFIP 
financial data to understand the available data. In addition, we obtained 
requested extracts of NFIP databases of the insurance premiums written 
and claim losses paid for these fiscal years to identify the total population 
including the number of transactions, and planned to select statistical 
samples of claims and policies to test from these databases. We reconciled 
the Bureau and Statistical Agent (BSA) extracts of net premiums written 
and claim losses paid databases to the BSA prepared financial statements 
based on the data provided to FEMA. Once we were able to successfully 



Vederal Financial Management Improvement Act of 1996, Pub. L. No. 104-208, div. A., § 
101(f), title VIII, 110 Stat. 3009, 3009-389 (Sept. 30, 1996). FFMIA was directed at ensuring 
that federal financial management systems provide accurate, reliable, and timely financial 
management information to government managers. FFMIA requires DHS and 23 other 
major departments and agencies to implement and maintain financial management systems 
that comply substantially with (1) federal financial management systems requirements, (2) 
federal accounting standards, and (3) the U.S. Government Standard General Ledger at 
the transaction level. 
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complete our reconciliation, 2 but before selecting samples, we performed 
data reliability tests on the databases and determined that the claims 
losses paid database was sufficiently reliable for our purposes. We did not 
audit the data that WYO companies submit to FEMA's contractor, CSC, 
nor did we audit the data produced by CSC or the information included by 
FEMA in DHS' annual reports. We used the statistical samples of insurance 
claim losses paid as outlined below to perform detailed testing through 
verification of data fields such as coverage and deductible amounts, claim 
payment amounts, and policy effective dates against source documents. 
We also used these samples to further test internal controls over NFIP 
financial reporting. Results from the statistical samples were projected by 
fiscal year both individually and combined. See table 1 below for details 
related to the statistical samples. 



Table 1 : 


Description of Claims Populations and Related Statistical Samples 






Fiscal 
year 


Type of sample 


Sample size 


Total dollar 
value of claim 
losses selected 
in the sample (in 
millions) 


Total number of 
claim losses in the 
sample population 


Total dollar value of 
claim losses in the 
sample population 
(in millions) 


2005 


Classical probability proportionate to size 
sample 


59 


16.0 


104,517 


2,694.5 


2006 


Classical probability proportionate to size 
sample 


59 


10.3 


189,776 


16,179.7 


2007 


Classical probability proportionate to size 
sample 


59 


6.3 


38,409 


885.4 



Source: GAO. 



Using the above statistical samples, we also tested other NFIP program- 
oversight controls as deemed necessary and in accordance with our 
engagement objectives. In order to ensure efficient detailed testing, we 
conducted dual-purpose testing, which includes reviewing dollar amounts 
as well as the related internal controls. We found information in the 
premiums written database was not sufficiently reliable for our purposes. 
We were unable to perform detailed testing of the premiums written 



2 We were able to successfully reconcile the second set of premium data we requested and 
received for fiscal years 2006 and 2007; a third set of premium data was requested for fiscal 
year 2005 and then we were able to reconcile this set. We performed this reconciliation 
between the financial statements and the database financial information. 
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database due to a significant number of data-reliability issues that we 
discovered. 

To evaluate oversight structures in place to monitor NFIP financial activity 
for the 3-year period covering 2005 to 2007, we reviewed prior GAO and 
DHS OIG reports to identify and follow up on any previously reported 
weaknesses or concerns, including sample selection for claims 
reinspections and tracking results of biennial financial audits. We also 
interviewed FEMA personnel and contractors regarding the oversight 
structures in place. In addition, we identified and assessed significant 
oversight structures as outlined in the WYO Financial Control Plan, and 
analyzed the results of these controls. 

To assess whether recent and planned actions to improve NFIP controls 
and the overall control environment are likely to address identified 
financial control weaknesses, we reviewed NFIP policy and procedural 
guidance that has been issued subsequent to the 2005 Gulf Coast 
hurricanes. We also met with key program officials to discuss the NextGen 
system development effort. We also discussed recent and planned NFIP 
program changes to address the internal control weaknesses and oversight 
issues previously identified by GAO and the DHS OIG. 
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Note: GAO comments 
supplementing those in 
the report text appear at 
the end of this appendix. 




December 4, 2009 



Ms. Susan Ragland 
Director 

Financial Management and Assurance 
U.S. Government Accountability Office 
441 G Street, NW 
Washington, DC 20548 

Dear Ms. Ragland: 

Re: Draft Report GAO-10-66, Financial Management: Improvements Needed in 
National Flood Insurance Program's Financial Controls and Oversight 
{GAO Job Code 195135) 

The Department of Homeland Security (Department) appreciates the opportunity to review 
and comment on the U.S. Government Accountability Office's (GAO's) draft report 
referenced above. The Department, specifically the Federal Emergency Management Agency 
(FEMA), disagrees with three of the seven recommendations and has concerns about the draft 
report narrative. 

To improve the financial reporting process and strengthen internal controls, GAO 
recommended that the Secretary of Homeland Security direct the acting assistant 
administrator, FEMA Mitigation Directorate, to take seven actions. 

GAO Recommendation 1 : Augment National Flood Insurance Program (NFIP) policies and 
procedures to require the Bureau and Statistical Agent (BSA) to use the transaction -level 
information that Write Your Own (WTO) companies submit to develop financial reports, in 
addition to the current practice of using transaction-level information solely for statistical 
purposes. 

FEMA's Response: FEMA disagrees with the recommendation. The NFIP' 3 financial 
statements have been audited for over 20 years and internal controls have been in place since 
the WYO program's inception. During that time, independent auditors, the Inspector General 
or the GAO have not suggested that the design of FEMA's financial repotting procedures is 
flawed. Implementing this recommendation would be onerous and burdensome because of 
the number of transactions involved, 

GAO Recommendation 2: Revise required internal control activities for the BSA to provide 
for verifying and validating the reliability of WYO-reported financial information based upon 
a review of a sample of the underlying transactions or events. 
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FEMA's Response: FEMA disagrees with the recommendation. The form and structure of 
the transaction level detail is audited at the source, including consideration of the relevance, 
reliability and accuracy of the transaction level detail. 

GAP Recommendation 3: Determine the feasibility of integrating and streamlining numerous 
existing NFIP financial reporting processes to reduce the risk of errors inherent in the manual 
recording of accounting transactions into multiple systems. 

FEMA's Response: FEMA agrees with the recommendation and is addressing it in the design 
of the new NFIP system. 

GAO Recommendation 4: Establish and implement procedures to require reviewing available 
information such as the results of biennial audits, operational reviews, and claim re- 
inspections to determine whether the targeted Audits for Cause managerial tool should be 
used. 

FEMA's Response: FEMA does not believe the recommendation is necessary. The NFIP has 
always had a process in place to review company performance and trigger Audits for Cause. 
The WYO Standards Committee considers the results of biennial audits, operation reviews 
and claims re-inspections when it reviews company performance and considers whether to 
recommend Audits for Cause. 

GAO Recommendation 5: Establish and implement procedures to require maintaining and 
considering current information from an independent source regarding state audit results to 
gather pertinent information such as customer service issues and inform detenmnarions about 
when to conduct Audits for Cause. 

i 

FEMA's Response: FEMA disagrees with the recommendation since State Departments of 
Insurance audits typically do not focus on the NFIP because it is a Federal insurance program. 
FEMA does receive correspondence from State Insurance Departments regarding issues of 
customer service with a Write- Your-Own Company. 

GAO Recommendation 6: Establish and implement procedures to schedule and conduct all 
required operational reviews within the prescribed 3 -year period. 

FEMA's Response: FEMA agrees with this recommendation. The new Operation Review- 
process will begin to address this recommendation in 2010. 

GAO Recommendation 7: Establish and implement procedures to select statistically 
representative samples of all claims as a basis for conducting re-inspections of claims by 
genera] adjusters. 

FEMA's Response: FEMA does not believe the recommendation is necessary. The NFIP 
selects a random sample for claims re-inspections and a statistically representative sample for 
Claims Operation Reviews. 
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See comment 1. 



Report incorporates 
additional detail on pages 
6, 7, 11, and 12 clarifying 
FEMA's use of manual 
processes. 



Background 

WYO Companies - Adjusting Claims 

GAO mistakenly asserts that the NFIP overpaid at ieast SI 13.6 million by not taking the 
deductible from total losses despite FEMA's numerous attempts to explain the flood 
insurance deductible. In wording that is comparable to that used throughout the property and 
casualty insurance industry, the Standard Flood Insurance Policy says it best. Section VI. A. 
of the Dwelling Form reads: 

When a loss is covered under this policy, we will pay oniy that part of the 
loss that exceeds your [the policyholder] deductible amount, subject to the 
limit of liability that applies. 

The value of the deductible is in small losses that are not payable until the covered loss 
exceeds the deductible amount. This is why deductible credits are given. For instance, if the 
policyholder purchases $250,000 of building coverage, the maximum NFIF limits available, 
with a $1,000 deductible, then no loss is payable until the covered loss exceeds $1,000, the 
deductible amount. When the covered loss is exactly $250,000, the deductible is taken from 
the covered loss and $249,000 is paid. However, if the covered loss is $251,000, the $1,000 
deductible is also taken from the covered loss and $250,000 is paid. If otherwise, a 
policyholder purchasing a $250,000 building limit of liability would rightfully be 
disappointed to learn that only $249,000 of the purchased limit could be paid regardless of the 
covered loss amount. If the covered loss is $252,000, the $1,000 deductible is taken from the 
covered loss, but - as the policy states - the payment is subject to the limit of liability that 
applies and only $250,000 is paid. 

The payment of the $250,000 policy limit does not necessarily indicate a total loss. A 
building's value could be more than the $250,000 policy limit and, as the example above 
demonstrates, the covered loss could be in excess of the $250,000 limits. The key is the 
payment is subject to the policy limits and no more than $250,000 may be paid. This 
treatment of the deductible has been used since the inception of the NFIP and is consistent 
with practices used by the property and casualty industry. Moreover, audits by the GAO, the 
Inspector General, and independent CPA firms have not indicated that there was a problem 
with the NFlP's application of the flood insurance deductible. 

NFIP's Financial Reportina Process 

GAO notes that the financial data received from the WYO companies is consolidated into a 
single file. However, this file is uploaded into Focus, not manually loaded or re-keyed. The 
Focus data is then automatically downloaded into the Traverse financial reporting system. 
The BSA personnel do not enter the data again as noted in the report and process flow chart. 
This misunderstanding of the financial reporting process was the basis for several inaccurate 
conclusions. 
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See comment 2. 



See comment 3. 



See comment 4. 

Report addresses on 
pages 11 and 12. 



Weaknesses in NFIP Transaction Controls and Processing Limited Accountability and 
Financial Reporting 

WYO Companies Did Not Provide Complete Documentation to FEMA for Claims 
Transactions 

The 2005 to 2007 period that GAO reviewed was unprecedented in NFIP history. In 2005, 
many of the 55,000 losses from four Florida hurricanes in 2004 and much of the associated $2 
billion in losses were paid. Losses from Hurricanes Katrina, Rita and Wilma were also paid 
primarily in 2005 and 2006. Hence, the $17.6 billion in paid losses for 2005 exceed the 
combined total losses for ail years since the NFlP's inception in 1978. These unprecedented 
times required unprecedented solutions. Because of the frequency (209,000 losses), 
complexity, and severity of the 2005 Hurricane Katrina losses, certain expedited claims 
procedures were put in place. Hence, the requirement to file the preliminary report and the 
final report was waived. 

GAO correctly describes the working of the Financial Assistance/Subsidy Arrangement. 
Companies are required to process NFIP losses in accordance with all the companies 
insurance policies. Over the years the Operation Reviews have determined that the 
information included in the NFIP forms are also provided by company proprietary forms. The 
particular company referred to in the report is among the three largest WYO companies; 
therefore the random sample reviewed by GAO may have produced a larger number of claims 
files for this company, which could have overstated the number of missing preliminary and 
final reports, 

BSA-level Internal Controls Do Not Verify Accuracy of WYO Company Data 

The internal controls for the front end balancing process include reconciliations, automated 
statistical edits, financial reconciliations, balanced exhibits, signed certifications by 
executives at the WYO companies, and policy, premium, and loss data detail edits in the 
information system. These controls have been in place and audited for over 20 years. 
Independent auditors, the Inspector General and the GAO have not suggested that the design 
of the internal controls governing FEMA's financial reporting procedures is flawed. The 
form and structure of the transaction level detail is audited at the source, including 
consideration of the relevance, reliability, and accuracy of the transaction level detail and this 
does not limit assurance or create material weaknesses in internal control. These recurring 
internal control reviews and external audits are not mentioned as mitigating consideration in 
the text of the report. 

The Design of FEMA's Financial Reportine for NFIP Activity is Flawed 

There appears to be a philosophical difference between GAO and FEMA regarding where the 
transaction level detail should reside. The design of NFIP' s processing system is based on 
distributed accountability at the WYO site with auditable compliance and oversight control at 
the Bureau and Statistical Agent and FEMA. Distributed accountability is not an internal 
control weakness and the design of FEMA's financial reporting for the NFIP is not flawed. 
FEMA does not rely on unverified WYO data and manual processing. GAO does not 
acknowledge this in the report and does not sufficiently take into account the assurances 
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provided by reconciliation controls and independent audits. FEMA officials believe the NFIP 
reports complete and accurate financial information that withstands audit scrutiny. 

Weaknesses in FEMA's Oversight Structure Limited Effectiveness in Monitoring NFIP 
Financial Activity 

FEMA Did Not Monitor Completion or Results of WYQ Company Audits 

In 2008, FEMA implemented a new process to track completion and review of the results of 
the required biennial audits. FEMA received all audits due in 2009 and, as necessary, 
followed-up with the WYO companies. 

GAO's suggestion that FEMA does not systematically monitor the WYO companies is 
incorrect. The WYO Standards Committee regularly reviews company performance 
including financial and statistical data submissions, claims and underwriting operational 
review results, biennial audit reports, and other material relating to company performance. 
Should performance fall below an acceptable level, the Committee can request an Audit for 
Cause. The Standards Committee's vigilant monitoring of the WYO companies has reduced 
if not eliminated the need for Audits for Cause, which GAO notes have not been done since 
the 1990s. Regarding State Departments of Insurance audits, these audits typically do not 
focus on the NFIP because it is a Federal insurance program. FEMA does receive 
correspondence from State Insurance Departments regarding issues of customer service with a 
Write -Your-Own Company. FEMA officials know of no independent source that could 
provide this information. 

Operational Reviews Are , Ineffective 

FEMA has revised its Operation Review process, which will be phased in beginning in 2010, 
to address GAO's concerns. WYO companies are on a three-year cycle for Operation 
Reviews. If a company fails a review, a follow-up review is scheduled within 12 months. 
The recently revised draft Financial Control Plan provides for a new process that addresses 
the vendor's small, medium, medium-large, and large client WYO companies. The large 
companies, those with more than 100,000 policies in force, are independently reviewed every 
three years. Small and medium sized companies can be pan of a combined review and are 
also on a three-year schedule. In addition, the new review process allows 30 additional 
randomly selected claims to be reviewed - 10 Increased Cost of Compliance claims, 10 
Residential Condominium Building Association Policy claims, and 10 Post-FIRM (Flood 
Insurance Rate Map) elevated building claims. 

With regard to Litigation Operation Reviews, FEMA explained to GAO that the litigation 
process is generally reviewed when a claim in litigation is selected randomly, however, 
FEMA insurance examiners also review all litigation claim expenses once the total fee 
exceeds a threshold amount. In this way, FEMA insurance examiners review the substance of 
a much greater number of utigation files than operation reviews would allow. 
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FEMA's Flawed Sampling Pro cedures Hamper its Claims Rein spection Prog ram 

The purpose of the claims reinspection program is to identify and mitigate procedural 
problems early in the claims adjustment process. FEMA has used a random sample of claims 
for reinspections since 2007. Reinspections are conducted as flood claims are occurring to 
minimize errors in the settlement of claims. Reinspections are not intended to be a definitive 
audit of the NFlP's claims handling process and hence, GAO's conclusion that "the agency 
cannot project the results of these reinspection oversight activities to confidently determine 
the overall accuracy of claims settled for specific flood events or assess the overall 
performance of insurance companies and their adjusters in fulfilling their NFIP 
responsibilities" is erroneous. 

Claims operation reviews are designed to provide feedback on claims settlements and 
ascertain compliance by WYO companies. In response to a previous GAO audit, FEMA 
began using a statistically representative sample for Claims Operation Reviews. GAO's 
misunderstanding of the two processes lead to incorrect conclusions regarding the efficacy of 
the claims reinspection program. 

Thank you again for the opportunity to comment on this draft report and we look forward to 
working with you on future homeland security issues. 

Sincerely, 




Director 

Departmental GAO/OIG Liaison Office 
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The following section provides GAO's comments on DHS' letter dated 
December 4, 2009. 



q^q QojjijjigjY^g 1- We deleted the footnote containing this estimate, although the draft 

u * " ^ - report did not characterize it as an overpayment. We revised the text on 

page 5 in the Background section to clarify our description of FEMA's 
claims adjustment process. 



2. Our report recognizes the unprecedented losses, but nevertheless the 
internal control issues we identified raise concerns that the amounts of the 
claims NFIP paid were not adequately supported even considering the 
expedited procedures in place at the time. 

3. Because we used a statistical sample from the insurance claim losses 
paid databases, our sample allows us to make generalizations about the 
population. The larger WYO companies that processed more claims would 
constitute a larger number of claims in our statistical sample. 

4. FEMA was unable to provide evidence of whether all WYO companies 
had completed biennial audits and had not reviewed the results of any 
biennial audits. Further, as discussed in our draft report, FEMA officials 
exempted certain WYO companies from the biennial audit requirement 
after the 2005 hurricane season. Therefore, FEMA had no assurance as to 
the accuracy or validity of WYO company transaction-level financial data. 
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